How to check an x402 endpoint before your agent pays it

How do I know an x402 endpoint is real before my agent pays it?

Start with the endpoint itself. Run the URL and every redirect through your own allowlist, SSRF guard and timeout, then call it once without paying. A working x402 endpoint answers 402 Payment Required and puts its terms in the response. In version 2 of the protocol the terms travel base64-encoded in a PAYMENT-REQUIRED header, and in version 1 they come back as JSON in the body. Both are still in use. On 12 October 2026 the demo weather endpoint used later in this guide answered with a version 1 body, while the Agents Trust API answers with the version 2 header.

Each entry in the accepts list is one way to pay, and a handful of fields decide where your money goes and how much of it. Most sit in each entry, and the URL the terms are for sits beside the list in version 2.

If the URL doesn’t answer 402, or the asset isn’t the token you expected, stop there. A clean challenge proves the server can ask for money and very little else. It can’t tell you whether the endpoint answered yesterday, whether anyone has ever paid it, or whether what comes back after payment is any good. The description in the challenge is the seller’s own text, so treat it as display copy and never as an instruction to your agent.

Is the price on an x402 listing trustworthy?

Treat a catalog price as a hint and the live 402 as the price. A catalog copies an endpoint’s terms at one moment and sellers can change their prices afterwards. Your agent signs the amount in the challenge it receives, so compare that amount with your own cap on every call, before signing. The x402 client libraries let you set the cap in code, and the payment section of the docs shows it in Python and TypeScript.

Inspect lists every offer it has stored for a URL under payment_offers, each with its source and the time it was captured. Our own probe is one source and catalogs such as Coinbase’s Bazaar are others. When those copies disagree, read captured_at before you believe any of them.

How do I know an endpoint that answered last week still answers today?

Read is_live together with probe_freshness and its timestamp. An unknown or stale result should never be treated as a current success. Inspect returns a stored record, so call the endpoint yourself to check whether it answers now.

Recommend also reports liveness evidence and its age. Use the returned status and freshness to judge whether you need another check, and read the endpoint’s current payment challenge before signing.

Can I see whether anyone has actually paid a given x402 endpoint?

Only partly, because a blockchain shows a payment from a payer’s wallet to the seller’s payTo wallet and nothing about which URL it was for. Some sellers run thousands of endpoints and most larger sellers use several wallets, so a payment can’t be pinned to one URL. Payment history belongs to the provider, and that is the level Agents Trust reports it at.

Inspect separates provider evidence from endpoint evidence. Read the returned fields at their stated level: provider payment history is not proof that the exact URL delivers. A null means unknown, never zero.

A long payment history does not guarantee a useful answer, and missing history does not prove that an endpoint will fail.

What should an agent check before it signs a payment to a URL it hasn’t called before?

Put the pieces together in this order.

1. Before the first request, run the URL through your own allowlist, SSRF guard and timeout, and apply the same checks to every redirect. Agents Trust checks a URL’s shape and probes it, and makes no claim that it is safe to call.
2. Call the URL unpaid and read the 402. Check the network, asset, amount, payTo and resource as described above.
3. Compare the amount with your own cap in atomic units and refuse anything above it.
4. Look up the URL with Inspect and read is_live with probe_freshness, the stored offers and risk_flags.
5. Read delivery_verification, and treat not_tested as unknown.
6. Only then sign, and send the paid request through the same guards.

Delivery is the thinnest part of any report. The delivery_verification block says whether Agents Trust has paid that exact URL in a test and judged what came back, with a status such as not_tested or verified. Paid tests cover a small set of endpoints so far, and a test of one URL is weak evidence about the same provider’s other URLs. When nothing has been tested the report carries the PAID_DELIVERY_NOT_TESTED risk flag, and every score in it describes the payment challenge rather than the answer you would get.

Inspect costs 1% of the looked-up endpoint’s own lowest price, never less than 0.001 USDC, paid over x402 on Base or Solana. The URL is validated and looked up before any payment is asked for. A malformed, private or non-HTTPS URL gets a 400 and a URL we hold no record for gets a 404, and neither is charged. A 404 only means we have no record of that URL, so it says nothing either way about the endpoint.

Try it without paying

The 10 demo URLs the site uses answer Inspect for free.

• https://api.agentstools.dev/forecast
• https://x402.tbs-digital.com/weather/now
• https://x402.shizu.me/weather
• https://api.strale.io/x402/weather-lookup
• https://netintel.dev/crypto/price
• https://crypto.apitoll.cloud/v1/crypto/price
• https://currency-api-production-4a8d.up.railway.app/crypto/price
• https://api.agentstools.dev/search
• https://x402.shizu.me/search
• https://4yearcycle.com/x402/web-search

curl -s 'https://api.agents-trust.com/inspect?url=https%3A%2F%2Fapi.strale.io%2Fx402%2Fweather-lookup&view=compact'

"lookup": { "match_type": "exact" },
"endpoint": {
  "liveness": {
    "is_live": 1,
    "probe_freshness": { "checked_at": "2026-10-11T18:49:09Z", "state": "fresh" }
  },
  "price": { "min_usd": 0.054, "max_usd": 0.054 },
  "networks": ["eip155:8453"],
  "seller": { "evidence_tier": "Unrated", "provider_score": 0.67 }
}

Any other indexed URL answers the same call with a 402, and its challenge tells you what that lookup costs before you pay for it. On 12 October 2026 our own challenge offered Base and Solana, both in USDC, at an amount of 1000, which is 0.001 USDC. This prints the decoded terms for any URL.

curl -si 'https://api.agents-trust.com/inspect?url=<url-encoded endpoint>' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 -d

If you don’t have a URL yet and need to find one for a task, Recommend ranks live endpoints for a need you describe, and the Inspect reference lists every field in the report. Other guides are on the guides page.